City of Janesville mistakenly releases Social Security numbers

Related Stories

JANESVILLE—A mistake by city of Janesville staff will cost the city at least $24,000.

The city announced Tuesday it mistakenly released Social Security numbers for 758 people who did business with the city since 2008.

The information was released Jan. 2 but discovered March 13 or 14, said city spokesperson Maggie Hrdlicka.

The information was released to Smart Procure, a company that specializes in gathering data from local, state and federal agencies. Businesses use the data to seek new customers and help them bid for government contracts.

The city sent letters to those affected Monday and offered to pay for identity-theft protection through LifeLock free of charge for one year.

“The city does not foresee any adverse effects occurring to any of the 758 vendors … ” the city said in a news release.

Nevertheless, the city opted to pay LifeLock $24,000 for unlimited subscriptions to LifeLock, which is cheaper than if the city paid for each person individually, Hrdlicka said.

The city said in a news release Tuesday that Smart Procure had displayed information from only 15 of the 758 vendors on its website, and no Social Security numbers were displayed.

Only three Smart Procure employees had access to the numbers, the city said.

The city demanded that Smart Procure destroy the information, and it did so, Hrdlicka said.

City staff members followed up twice, seeking assurances that Smart Procure had deleted backup copies and cached copies and were assured that was done, Hrdlicka said.

As far as staff members know, this was the first time the city had received this kind of request about vendors, Hrdlicka said. Other open-records requests have been processed correctly, with certain information redacted, Hrdlicka said.

Staff members are preparing a policy change for city council approval that would cover this situation in the future. The policy likely will require certain kinds of requests to receive a final review by the city attorney, Hrdlicka said.

Hrdlicka said she could not comment on who was responsible for releasing the report or whether anyone would be disciplined because it's a personnel issue.

City ordinance specifies a custodian of records who is in charge of releasing information, and generally it's the department or division head, which in this case is the city comptroller, Hrdlicka said.

The information was generated using New World software, which the city has used since 2012.

The error was discovered when Smart Procure made a second request in March. A city staff member noticed that the New World report included the Social Security numbers, and a further check revealed the previous release.

The New World software automatically generated tax ID numbers for each vendor. Those numbers can be released under state law, Hrdlicka said. If the vendor did not have that number, however, the person's Social Security number was used.

The January information release included about 7,000 vendors, but only 758 used Social Security numbers, Hrdlicka said.

The city has set up a hot line to handle questions or concerns -- 608-373-6000. The city was already receiving calls Tuesday afternoon, Hrdlicka said.